AN0467
Analytic 0467
Linux
Detects adversary behavior clearing command history via `history -c`, deletion or modification of ~/.bash_history, or manipulation of the HISTFILE environment variable post-login.
auditd:SYSCALL
execve
auditd:SYSCALL
PATH
[TimeWindow]
Detect shell history clearing shortly after login or command execution.
[UserContext]
Elevated shell sessions (e.g., root or sudo) without command history may be more suspicious.
[HistoryFilePath]
Bash/Zsh history file paths (e.g., ~/.bash_history, ~/.zsh_history).
AN0468
Analytic 0468
macOS
Detects adversary clearing shell history using `history -c` or deleting/altering ~/.zsh_history or ~/.bash_history. Focus on sessions with missing or wiped history.
macos:unifiedlog
process
fs:fsusage
unlink, write
[TimeWindow]
Duration after terminal usage where deletion or modification is considered suspicious.
[UserContext]
Flag unexpected user activity, especially from users who normally don’t use terminal.
[HistoryFilePath]
Zsh or Bash history files under the user's home directory.
AN0469
Analytic 0469
Windows
Detects PowerShell `Clear-History` invocation or deletion of `ConsoleHost_history.txt` to erase past PowerShell session history.
WinEventLog:PowerShell
EventCode=4103, 4104, 4105, 4106
WinEventLog:Sysmon
EventCode=23
WinEventLog:Security
EventCode=4663, 4670, 4656
[HistoryFilePath]
Path to PSReadLine file, typically in APPDATA.
[UserContext]
User account or role performing deletion (e.g., low-priv user deleting history).
[CommandPattern]
Support detection of `Clear-History` and variations.
AN0470
Analytic 0470
ESXi
Detects modification or truncation of `/var/log/shell.log` used to persist ESXi shell command history. Especially suspicious shortly after login or config changes.
esxi:shell
/var/log/shell.log
[LogFilePath]
Path to shell command history on ESXi.
[TimeWindow]
Time range post-login or privileged escalation.
AN0471
Analytic 0471
Network Devices
Detects use of `clear history` or `clear logging` commands on network device CLI to remove past activity logs.
networkdevice:syslog
CLI command audit
[CommandPattern]
Support detection of known variants: 'clear history', 'clear logging', etc.
[DeviceType]
Router, switch, firewall—may have different CLI behaviors.